@PickleRickthanks for all the help so far, it definitely looks I'm not getting data to pull in 100% correctly. When I did NMAP for the entire subnet from my Kali box (172.30.4.244) it's only being represented as two scans each time, even though I'm scanning the entire /21 subnet for port 22, and it's showing the destination port as 254.   ... View more

@PickleRick, I wasn't sure what to replace index=<your_index> with so I left index* 😐 but this is a sample output: ... View more

Thank you for the suggestion @PickleRick, I updated it to sourcetype=meraki_syslog I just ran this query: index=* sourcetype=meraki_syslog src=172.30.4.166 and I'm seeing all the live traffic, here's an example one: Outbound: Jun  9 13:47:57 172.30.7.254 1 1654807677.409363608 meraki_firewall ip_flow_start src=172.30.4.166 dst=OUTBOUND_PUBLIC_IP protocol=tcp sport=40526 dport=443 translated_src_ip=OUR_EXTERNAL_BROADCAST_IP translated_port=40526 host = 172.30.7.254 source = udp:514 sourcetype = meraki_syslog I ran this query: index=* sourcetype=meraki_syslog src=172.30.0.0/21 dst=172.30.0.0/21 Internal: Jun  9 13:50:52 172.30.7.254 1 1654807852.363523623 meraki_firewall ip_flow_start src=172.30.4.89 dst=172.30.7.255 protocol=udp sport=43877 dport=15600 translated_dst_ip=172.30.7.255 translated_port=15600 host = 172.30.7.254 source = udp:514 sourcetype = meraki_syslog ... View more